Overview

overview

10

Static

static

4355077d9e...2a.exe

windows7_x64

10

4355077d9e...2a.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    29-12-2020 01:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe

  • Size

    214KB

  • MD5

    b130cfd3d346bd719bd1e38f051768d2

  • SHA1

    de29701a3f0d6c24a6e10717e35379ed702db868

  • SHA256

    4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

  • SHA512

    33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

Score
10/10
buranpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: kevin.2021@yandex.com and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: kevin.2021@yandex.com Reserved email: maarten.2021@yandex.com Your personal ID: 123-666-694 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

kevin.2021@yandex.com

maarten.2021@yandex.com

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 23888 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 7854 IoCs
  • Suspicious use of AdjustPrivilegeToken 89 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe
    "C:\Users\Admin\AppData\Local\Temp\4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3176
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2552
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:2460
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
          3⤵
            PID:3948
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:528
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:2456
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3204
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:448
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:1364
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe" -agent 0
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:584
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
            3⤵
              PID:4084
          • C:\Windows\SysWOW64\notepad.exe
            notepad.exe
            2⤵
            • Deletes itself
            PID:2628
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2164

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Privilege Escalation

        Defense Evasion

        File Deletion

        2
        T1107

        Modify Registry

        2
        T1112

        Install Root Certificate

        1
        T1130

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        Peripheral Device Discovery

        1
        T1120

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Web Service

        1
        T1102

        Impact

        Inhibit System Recovery

        2
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
          MD5

          61466c45ced4d83183fdb25396d4031c

          SHA1

          28a0f84a224cfddee721d7aa7cc5b54176358108

          SHA256

          1c3119bf6b52b905a989b256f6d40bf6d0150eb5485f5c416362a439e620e4f9

          SHA512

          152535df0af05a287d4435e702c9fc86195e61296e825b9bd67311054524bbeeb898aa4b23393c5af5d4f5fa2471fbe56b3d85964036d22b5ba751c8b3423e9c

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
          MD5

          21ef137d48d04fc9be98c2674223aa7d

          SHA1

          2c596c1c53112a535400e16fe124987aa665055c

          SHA256

          d265ed9b6513b4a1bc4b7b26f3f59b1ed4d0cf1aeb37bc0d38ec91b4658cc0e0

          SHA512

          f95cf62b52edf668adf1779d07bde1c68c29b848ec713270111b3fa2bc01edbdbbc5cfc958229c6e92567f4196285e935a2f922bbdcac80f9103ba15e832491a

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          MD5

          9d7369bfa72ae89d1d752ba17df6c22e

          SHA1

          ec6dad338b059d7bffbf47f84cf3c638226a0d82

          SHA256

          8ba91b47832e7c92ce4aec0255ae6511d12f7f92201d8d1db21d37f81a190030

          SHA512

          3cc58981fdaffa95022fbf13d7b0535ef0d1700fffda235a46902f9b9d9ac83458d8444aedae99b8392ee62d0151eea5f67d991bf538aa0919fcd5b6f7ae41f5

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
          MD5

          5470a980209672478f1536cb99456607

          SHA1

          899436319a8a3337f5bdf75bb46d240f2bc81c0c

          SHA256

          3f3b750ae83fdae6056705b81f1251ba30617e1e73d5478a627a66f3dc9bc7c5

          SHA512

          a8c34a459128657cec2f00402048f9ba9bd9d3575931a7312b09005310c0c1cf214ac55c6cc5d11bd846033b6bc5b62a43f068673f977c393872a904c6ebed65

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
          MD5

          489925b75edf65bff01cf1257804443f

          SHA1

          6813f05404c3170c11ddc5ff20f01b38db0f78a7

          SHA256

          a60e61b0fffac84b5bf44a433a26c41ca46b99c8d984461a2a2fd2f4b18f139c

          SHA512

          6a3c2d8228f7ac54390913664588c95c5e7af5caea48e66e1daeec9d8d9cc8c96e704fbad66f48d08efe776f44f02b3fc8815011ee367364d437f8da6e2a00cb

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          MD5

          b21a6041b59598bd241e5c1b3078110f

          SHA1

          42335ee6430ac70fc8ac5a7c40214206050d7d44

          SHA256

          115966b9525b5cbf8632b51f53bffe3440ebf65104232917c14ff55779bd10e9

          SHA512

          a68c97302e5154c87251e2e7bb8eb54d07b2f95121494e5e0647fa71cd300cd655d73179c21bc71091987e586f47b753d3d9b1f7cf7ab623a9a1a2147c09f664

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\RON2FB61.htm
          MD5

          6b17a59cec1a7783febae9aa55c56556

          SHA1

          01d4581e2b3a6348679147a915a0b22b2a66643a

          SHA256

          66987b14b90d41632be98836f9601b12e7f329ffab05595887889c9c5716fbeb

          SHA512

          3337efd12b9c06b7768eb928a78caae243b75257c5aabe7a49e908a2f735af55f7257a40bd2330dc13865ead18ed805b54a6c5105740fdcbbaccacf7997bcbc3

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S7PGJ114\9KG7416N.htm
          MD5

          b1cd7c031debba3a5c77b39b6791c1a7

          SHA1

          e5d91e14e9c685b06f00e550d9e189deb2075f76

          SHA256

          57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

          SHA512

          d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
          MD5

          ef572e2c7b1bbd57654b36e8dcfdc37a

          SHA1

          b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

          SHA256

          e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

          SHA512

          b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe
          MD5

          b130cfd3d346bd719bd1e38f051768d2

          SHA1

          de29701a3f0d6c24a6e10717e35379ed702db868

          SHA256

          4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

          SHA512

          33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe
          MD5

          b130cfd3d346bd719bd1e38f051768d2

          SHA1

          de29701a3f0d6c24a6e10717e35379ed702db868

          SHA256

          4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

          SHA512

          33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe
          MD5

          b130cfd3d346bd719bd1e38f051768d2

          SHA1

          de29701a3f0d6c24a6e10717e35379ed702db868

          SHA256

          4355077d9e650cde600c29caf7fc7128ebb1f42331f130bbfe0e66265c67022a

          SHA512

          33811ddb6ff9715e337bcbb0923b23cdc0e8ee8dca1cb7d85a175e5d40e7deb3c23fbe0010b829b8289de86268440e6806ee5df06447c8102707c84e8389222e

          Download Submit
        • memory/448-26-0x0000000000000000-mapping.dmp
          Download
        • memory/528-19-0x0000000000000000-mapping.dmp
          Download
        • memory/584-21-0x0000000000000000-mapping.dmp
          Download
        • memory/1364-27-0x0000000000000000-mapping.dmp
          Download
        • memory/2456-23-0x0000000000000000-mapping.dmp
          Download
        • memory/2460-16-0x0000000000000000-mapping.dmp
          Download
        • memory/2552-24-0x0000000000000000-mapping.dmp
          Download
        • memory/2628-5-0x0000000001030000-0x0000000001031000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2628-6-0x0000000000000000-mapping.dmp
          Download
        • memory/2636-2-0x0000000000000000-mapping.dmp
          Download
        • memory/3176-15-0x0000000000000000-mapping.dmp
          Download
        • memory/3204-20-0x0000000000000000-mapping.dmp
          Download
        • memory/3948-18-0x0000000000000000-mapping.dmp
          Download
        • memory/4084-17-0x0000000000000000-mapping.dmp
          Download